Heap-based buffer overflow in VMware vCenter Server
Priority HIGH 82CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.12478 96th percentileScored 2026-11-07
Fix Fixed VMware vCenter Server: 8.0 U2d, 8.0 U1e, 7.0 U3r
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | VMware vCenter Server | 8.0 to before 8.0 U2d; 8.0 to before 8.0 U1e; 7.0 to before 7.0 U3r | 8.0 U2d, 8.0 U1e, 7.0 U3r | Patch available | CNA |
| — | VMware Cloud Foundation | 5.x; 4.x | — | No fix listed | CNA |
- VMware vCenter Server Vendor— Affected 8.0 to before 8.0 U2d; 8.0 to before 8.0 U1e; 7.0 to before 7.0 U3r Fixed in 8.0 U2d, 8.0 U1e, 7.0 U3r Patch available CNA
- VMware Cloud Foundation Vendor— Affected 5.x; 4.x Fixed in — No fix listed CNA
CPE configurations NVD · 44
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:* | 8.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:* | 8.0 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:* | 8.0 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:* | 8.0 c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:* | 8.0 update1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:* | 8.0 update1a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:* | 8.0 update1b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:* | 8.0 update1c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:* | 8.0 update1d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:* | 8.0 update2 | Vulnerable | VMware |
- cpe:2.3:a:vmware:vcenter_server:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1:*:*:*:*:*:* Versions 8.0 update1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1a:*:*:*:*:*:* Versions 8.0 update1a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1b:*:*:*:*:*:* Versions 8.0 update1b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1c:*:*:*:*:*:* Versions 8.0 update1c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update1d:*:*:*:*:*:* Versions 8.0 update1d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2:*:*:*:*:*:* Versions 8.0 update2 Vulnerable ·VMware
Show 34 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:* | 8.0 update2a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:* | 8.0 update2b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:* | 8.0 update2c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* | 7.0 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* | 7.0 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* | 7.0 c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* | 7.0 d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* | 7.0 update1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* | 7.0 update1a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* | 7.0 update1c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* | 7.0 update1d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* | 7.0 update2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* | 7.0 update2a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* | 7.0 update2b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* | 7.0 update2c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* | 7.0 update2d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:* | 7.0 update3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:* | 7.0 update3a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:* | 7.0 update3c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:* | 7.0 update3d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:* | 7.0 update3e | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:* | 7.0 update3f | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:* | 7.0 update3g | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:* | 7.0 update3h | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:* | 7.0 update3i | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:* | 7.0 update3j | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:* | 7.0 update3k | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:* | 7.0 update3l | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:* | 7.0 update3m | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:* | 7.0 update3n | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:* | 7.0 update3o | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:* | 7.0 update3p | Vulnerable | VMware |
| cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* | 4.0 to before 5.2 | Running on | VMware |
- cpe:2.3:a:vmware:vcenter_server:8.0:update2a:*:*:*:*:*:* Versions 8.0 update2a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2b:*:*:*:*:*:* Versions 8.0 update2b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:8.0:update2c:*:*:*:*:*:* Versions 8.0 update2c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* Versions 7.0 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* Versions 7.0 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* Versions 7.0 c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* Versions 7.0 d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* Versions 7.0 update1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* Versions 7.0 update1a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1c:*:*:*:*:*:* Versions 7.0 update1c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1d:*:*:*:*:*:* Versions 7.0 update1d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2:*:*:*:*:*:* Versions 7.0 update2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2a:*:*:*:*:*:* Versions 7.0 update2a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2b:*:*:*:*:*:* Versions 7.0 update2b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2c:*:*:*:*:*:* Versions 7.0 update2c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update2d:*:*:*:*:*:* Versions 7.0 update2d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3:*:*:*:*:*:* Versions 7.0 update3 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3a:*:*:*:*:*:* Versions 7.0 update3a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3c:*:*:*:*:*:* Versions 7.0 update3c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3d:*:*:*:*:*:* Versions 7.0 update3d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3e:*:*:*:*:*:* Versions 7.0 update3e Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3f:*:*:*:*:*:* Versions 7.0 update3f Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3g:*:*:*:*:*:* Versions 7.0 update3g Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3h:*:*:*:*:*:* Versions 7.0 update3h Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3i:*:*:*:*:*:* Versions 7.0 update3i Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3j:*:*:*:*:*:* Versions 7.0 update3j Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3k:*:*:*:*:*:* Versions 7.0 update3k Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3l:*:*:*:*:*:* Versions 7.0 update3l Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3m:*:*:*:*:*:* Versions 7.0 update3m Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3n:*:*:*:*:*:* Versions 7.0 update3n Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3o:*:*:*:*:*:* Versions 7.0 update3o Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update3p:*:*:*:*:*:* Versions 7.0 update3p Vulnerable ·VMware
- cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 4.0 to before 5.2 Running on ·VMware
Remediation
- Fix · CNA VMware vCenter Server Fixed in 8.0 U2d, 8.0 U1e, 7.0 U3r
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
VMware vCenter Server 7.0 U3r, 8.0 U1e, 8.0 U2d
2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 HIGH
Other records, highest priority first
- TI-2024-24610 Out-of-bounds write in VMware vCenter ServerPriority CRITICAL 100
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37080
- 2026-10-03 Alias added: GHSA-mw3w-f2gc-g47m
References
More VMware Vcenter Server vulnerabilities
- TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-37080 · CVE Program
- CVE-2024-37080 · NVD
- FIRST EPSS
- GHSA-mw3w-f2gc-g47m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences